Field of the Invention
The present invention relates to systems and methods for protection against the operation of malware commonly used in identify-theft and cyber-fraud. In particular, but not by way of limitation, the present invention relates to systems and methods for preventing key logger malware that utilizes form grabbing techniques to steal financial and identity information from users' browsers.
Description of the Background Art
Identity Theft and Criminal Malware Targeting Browsers
Personal computers and business computers are widely infected with malicious software that intercepts and steals critical personal and financial information as it is being called by the user's browser. Almost all online commerce and activity originates from a user electing to open an internet browser to conduct business, either with his or her bank, brokerage, investment manager, or with numerous online stores.
Because of the massive growth in online commerce, and the requirement and use of credit cards and personal data to facilitate that market, sophisticated criminal hackers have targeted this line of commerce with ever-evolving malware. Much of the sophisticated malware is not being caught by commercial anti-virus solutions. Thus, unwitting consumers, believing they are protected, often enter the stream of online commerce not recognizing that malware can, and is, stealing their critical information. This sophisticated theft is taking place due in large part to the rise of what is called key logging malware. Key logging malware is created, often by sophisticated criminal online syndicates, to facilitate the capture of passwords, credit card data, and personal credentials, generally without the person's knowledge.
Key Logging Malware Avoids Detection
Key logging is a method of capturing keyboard input to a computer or computing device. It is a common technique for obtaining passwords and sensitive information using unauthorized software.
Software key loggers capture targeted personal data stored on the computers they infect. The software key loggers are utilized in conjunction with legitimate programs on the infected system. The malware relays the captured data to unauthorized recipients, who have planted the malware on the system by sending that data thru the internet using TCP/IP ports often used by common user applications. Software Key loggers utilize a number of techniques including hooking various operating system Application Programming Interfaces (APIs) and system drivers, screen capture, and form grabbing and hook based keystroke logging.
Hook Based Key Logging Malware
Another technique is hook-based key logging. Hook-based key loggers are programs that insert a system API hook into an API stack by modifying import tables, via insertion of inline hooks, or invoking SetWindowsHookEx( ). This is done by placing a call object into the API stack, acting as a filter. When a user on his or her browser calls a website, the data are filtered thru this malware call. This allows an attacker to record all the data being passed by the system driver to the API stack of a web browser. For example, one type of hook-based key logger will monitor and record each key press that generates an Interrupt Request (IRQ) to the system driver on the motherboard. The key logger, as part of the malware, saves this data as a text file. The text file is subsequently sent to a remote location for retrieval by malefactors.
Malefactors commonly deploy such malware key loggers via the internet to the computers of thousands of unsuspecting users. The volume of data generated by such hook-based key loggers is great, and can amount to many gigabytes of data within a short period. This mass of data is cumbersome to store and difficult to search for the purpose of extracting the very small percentage of data that represents data inputs of interest (e.g., credential and password information). As a result, malefactors have fine-tuned their malware to meet these challenges and better reduce the large take of useless data stolen by their malware.
The Rise of Form-Grabbing Key Loggers
Form-grabbing key loggers insert a hook that captures the form data, and only form data inputs. The form information being stolen is, essentially, those forms used for online banking and other online commerce that require users to enter personal information, card data, passwords, reminder questions, and mother's maiden names. This perfection of the malware allows more precise targeting of stolen credentials, and it greatly increases the odds that credentials stolen will be found and used. Previous methods often resulted in so much data being siphoned out by malware that credentials of interest to financial criminals and identity thieves were buried in the sea of stolen data. This is no longer the case with form-grabbing key loggers.
Form-grabbing key loggers have become a preferred type of key logger for sophisticated cyber criminals due to (1) their resistance to detection and lack of effective countermeasures, (2) their effect of substantially reducing the volume of captured data that must be searched to extract credentials, and (3) almost all credentials used for online transactions are entered at some point into a web form. Form-grabbing key loggers have become the first choice for cyber criminals when targeting bank login data.
Form grabbers sit in between the internet browser and the called internet page. This allows an inserted browser extension to inject or directly access the browser's API functions. This allows all data passed to the form to be recorded as it is passed by the browser. This method of action defeats all known anti-key loggers as they do not protect the web form or the browser window API's. As an example, when a user submits data to a legitimate banking website using web forms, a form-grabbing key logger that is monitoring the web browser can grab the submitted data by injecting a hook and hooking API functions within the browser.
Form grabbers deal with the browser and the data being passed over the internet. Hook-based key loggers record data as it is passed thru the API or system driver.
Form-grabbing key loggers also succeed in recording and stealing automatic form filler data as well as any data copied from another location such as data pasted from a clip board.
Methods to Stop and Detect Key-Loggers
Software is available to detect and remove many types of malware. Attempts to combat all forms of key logger malware have not been successful. Moreover, consumers falsely rely on commercial anti-virus products that are often not updated with the latest version, and even when fully updated or patched, are ineffective to address the root problem of form-grabbing key loggers.
Software is available to address some elements of software key loggers. A number of methods are available to detect and/or disable hook-based key loggers. All known methods deal with accessing the API stack directly. Another approach is represented by the KeyScrambler® product from QFX Software Corporation (Ormand Beach, Fla.) which employs an encryption-based method. According to this method, keystroke data is encrypted at the source (keyboard) and passed to a form in a decrypted format. Another variation of this method is used in the GuardiD® product of StrikeForce Technologies Inc. of Edison, N.J. that utilizes similar API hooking and key-scrambling methods but does not protect the user if the malware is inserting itself as a hook-based key logger at the first instance in the stack. Moreover, this method does not effectively protect users against form grabber threats.
US 2007/0240212 attempts to counter the action of key logger malware by creating a keyboard driver and hooking into various running windows processes. In particular, it creates a keystroke unhook or bypass method. A program engine hooks windows processes and performs a monitoring action in which it looks for hooked calls. When a hooked call is detected, it injects a program and launches new processes. This method creates a false entry state and a false exit state whereby the keystroke data is passed thru these states, i.e., bypassing a keystroke logger hook, by using a separate windows keyboard driver. This method may counter hook-based key loggers but is likely to cause system instability due to the fact it injects into running window processes, a technique which is known to cause memory corruption and system failures. Moreover, a simple modification by the authors of key logger malware would allow such malware to identify the anti-key logger driver file and hook this process instead, thus allowing the key logger to capture the users keystrokes as they pass through that process. This method does not protect against the action of hook-based key loggers that are programmed to insert themselves prior to the anti-key logger (“AKL”) itself hooking within the API stack, thus making it ineffective against the current generation of form grabbing key logger malware.
It is an object of an embodiment of the present invention to provide a solution to protect against key loggers that is not disruptive of the system and does not depend on user experience by, for example, asking the user to determine whether flagged processes or programs should be allowed to operate. The solution of the present invention does not depend on detection of malware at all. An embodiment of the present invention, instead, defeats the action of form-grabbing key loggers. An embodiment of the present invention can likewise defeat the action of hook-based key loggers that are capable of operating in the presence of scramblers.
It is the further object of this invention to provide a solution that is compatible with all common widely deployed browsers and without requiring a change of browsers by users.